CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability that permits administrative users to gain full control over the underlying server.

This is an improper control of code generation (CWE-94) flaw where the content editing functionality fails to restrict the upload of executable PHP files. An attacker with administrative privileges can manipulate the CSRF token mechanism to inject and execute arbitrary server-side code.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the server, leading to a total compromise of the application and its data. Given the CVSS score of 8.8, this represents a high-severity risk that could result in full system takeover, unauthorized access to sensitive databases, and potential lateral movement within the network.

Immediate Action: Upgrade CMSimple_XH to the latest version available from the vendor, as older versions like 1.7.4 are confirmed to be vulnerable.

Proactive Monitoring: Review web server access logs for anomalous requests to the content editing endpoint or unexpected calls to newly created PHP files in the web root.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized file upload attempts and restrict access to administrative interfaces by IP address to reduce the attack surface.

Public Exploit Available: Yes, a functional exploit script is available on ExploitDB.

The vulnerability presents a significant risk to the integrity and availability of the affected server. Administrators must prioritize updating the CMSimple_XH installation to a patched version immediately. Given the availability of a public exploit script, the window for remediation is narrow, and organizations should audit their administrative user accounts to ensure no unauthorized access has occurred.